ETS 108 – Automatic Processing of Personal Data, 28.I.1981 __________________________________________________________________________________ Article 9 – Exceptions and restrictions 1 No exception to the provisions of Articles 5, 6 and 8 of this Convention shall be allowed except within the limits defined in this article. 2 Derogation from the provisions of Articles 5, 6 and 8 of this Convention shall be allowed when such derogation is provided for by the law of the Party and constitutes a necessary measure in a democratic society in the interests of: 3 a protecting State security, public safety, the monetary interests of the State or the suppression of criminal offences; b protecting the data subject or the rights and freedoms of others. Restrictions on the exercise of the rights specified in Article 8, paragraphs b, c and d, may be provided by law with respect to automated personal data files used for statistics or for scientific research purposes when there is obviously no risk of an infringement of the privacy of the data subjects. Article 10 – Sanctions and remedies Each Party undertakes to establish appropriate sanctions and remedies for violations of provisions of domestic law giving effect to the basic principles for data protection set out in this chapter. Article 11 – Extended protection None of the provisions of this chapter shall be interpreted as limiting or otherwise affecting the possibility for a Party to grant data subjects a wider measure of protection than that stipulated in this Convention. Chapter III – Transborder data flows Article 12 – Transborder flows of personal data and domestic law 1 The following provisions shall apply to the transfer across national borders, by whatever medium, of personal data undergoing automatic processing or collected with a view to their being automatically processed. 2 A Party shall not, for the sole purpose of the protection of privacy, prohibit or subject to special authorisation transborder flows of personal data going to the territory of another Party. 3 Nevertheless, each Party shall be entitled to derogate from the provisions of paragraph 2: a insofar as its legislation includes specific regulations for certain categories of personal data or of automated personal data files, because of the nature of those data or those files, except where the regulations of the other Party provide an equivalent protection; b when the transfer is made from its territory to the territory of a non-Contracting State through the intermediary of the territory of another Party, in order to avoid such transfers resulting in circumvention of the legislation of the Party referred to at the beginning of this paragraph. 4